Vulnerability without patch exposes NTLMv2 to links manipulated by URI handlers

Cybersecurity researchers have described a patch-free vulnerability that allows an attacker to cause the filtration of a user's NTLMv2 hash by inducing the opening of manipulated links in the browser. Although mechanics recalls the incident solved in April 2026 with the URI handle of the Snipping Tool (ms-screenshot), the new technique takes advantage of the handle search: with type parameters crumb = location: to force the system to connect against a resource controlled by the attacker and thus capture the Net-NTLMv2 that the team tries to send to authenticate.

The root of the problem is the same type of failure: a protocol handler that accepts parameters provided by the user without validating them and that, when processing them, causes a outgoing connection to UNC routes. That connection to a malicious SMB server triggers the NTLM protocol and exposes the hash, which an attacker can use for relay or to try to authenticate within a compromised network. Previous cases had already shown how parameters such as filePath or crumb could be exploited for the same purpose; companies like Varonis have documented uses of crumb In 2024, and suppliers like Huntress have published analysis of recent derivations.

Microsoft's decision not to publish a patch for this finding on the argument that it did not reach its threshold of gravity for servicing leaves organizations in the face of a specific operational risk: in the absence of an official arrangement, vectors are still exploitable by actors who can attract users to malicious links embedded in mail or web pages. This makes the protection on the periphery of the network and the policies of control of protocol and port in workstations particularly relevant.

In terms of impact, the exposure of Net-NTLMv2 is dangerous because hash can serve as a basis for relay attacks and side movements, and because many corporate environments continue to allow or tolerate NTLM for compatibility with legacy software. A single has high privileges whose partial credential is filtered can facilitate climbing and persistence in a network, with consequences that include data exfiltration, malware deployment or internal service commitment.

As practical and viable immediate countermeasures, it is advisable to block outgoing SMB traffic (TCP / 445 and TCP / 139) in equipment that does not need to communicate with internal servers through these ports from public networks or unsafe subnetworks. In addition, forcing SMB signature and enabling extended authentication protection policies reduces the possibility of a captured hash being successfully reused against it. Where feasible, organizations should plan to phase out NTLM in favour of Kerberos and other safer authentication.

From the detection and response layer, you need to monitor unusual attempts at NTLM authentication to external destinations, review SMB connection records and deploy EDR rules that alert processes that launch URI handlers with external parameters. Staff awareness remains critical: social engineering techniques that induce the click remain the preferred vector, so training and filtering of sandboxing mail helps reduce the likelihood of exploitation.

At the strategic level, this incident recalls two lessons: first, that local protocol managers can become exit doors if they accept unvalidated entries; second, that the decisions of suppliers on what parking may leave gaps that require countermeasures at the level of configuration and architecture by security officials. Implementing network segmentation, egress restrictions and host firewall rules are measures that will mitigate exposure while waiting for a formal patch.

Those who want to deepen can read analysis and technical publications from the teams that have investigated variants of this attack on specialized blogs and official documentation about NTLM and SMB. Useful resources for contextualizing and planning mitigation include the input of manufacturers and community on NTLM and SMB management, such as Microsoft technical documentation on NTLM and the publications of security companies that have documented holdings with parameters in URI managers: https: / / learn.microsoft.com / en-us / windows-server / security / ntlm / and https: / / www.varonis.com / blog, in addition to reports and research blogs of specialized sites such as https: / / www.huntress.com / blog.

Finally, my recommendation for IT and safety managers is to prioritize controls that do not depend on a supplier patch: to block unnecessary outgoing SMB, strengthen SMB signature, plan NTLM deactivation and improve authentication monitoring. These measures reduce the opportunity window of the attackers and raise the operating cost even if the vulnerability remains uncorrected by the manufacturer.